Zero-Day Vulnerability

A flaw before there is a fix

A newly found flaw in a phone’s software has no fix yet. Someone might find a way to use it to read private information. The flaw is a zero-day vulnerability; the way to use it is a zero-day exploit.

Finding a zero-day does not mean anyone has attacked it. Once a fix is available, it is no longer a zero-day, although devices still need to be updated.

What teams do while waiting

Teams check whether they use the affected software and how exposed it is. Until a fix is ready, they may turn off the weak feature or restrict access. They then test and apply the fix.